Dashboards & Visualizations

VIEWS : HOWTO create a subfolders structure under views' folder

nik_splunk
Path Finder

Good morning splunkers,

Instead of keep all views created for an app into the <myappfolder>\default(or LOCAL)\data\ui\views, does exist a way to tell Splunk those views are at the same location but organized into some subfolders ?

Examples>

  • <myappfolder>\default(or LOCAL)\data\ui\views\folder1
  • <myappfolder>\default(or LOCAL)\data\ui\views\folder2
  • <myappfolder>\default(or LOCAL)\data\ui\views\folderN

Thanks in advance for your time and support.

nik

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

No I dont think there's any way you can have a subfolder in the views directory. I just tried it out to make sure and they dont come back from the EAI endpoint so that means they dont really exist at all.

It's unfortunate because apps can grow quite large. One strategy followed by some of the larger apps like ESS and the Cisco app is to organize whole areas of functionality into smaller apps that are marked with is_visible=False in their app.conf. At that point it's called an 'addon' instead of an 'app', but anyway those 'addons' then each promote all of their content into the the global space, and then there's a single master app (that we at that point call a 'suite') whose navigation then organizes all the views from the various component addons beneath it.

This is quite an undertaking and not without its downsides, but I mention this because if you're at the point where you have 20 or 50 views in there, you may be having other organizational problems you want to solve too...

Note: in an app folders for static files can have subfolders although many people dont know this (etc//appserver/static can have subfolders)

View solution in original post

sideview
SplunkTrust
SplunkTrust

No I dont think there's any way you can have a subfolder in the views directory. I just tried it out to make sure and they dont come back from the EAI endpoint so that means they dont really exist at all.

It's unfortunate because apps can grow quite large. One strategy followed by some of the larger apps like ESS and the Cisco app is to organize whole areas of functionality into smaller apps that are marked with is_visible=False in their app.conf. At that point it's called an 'addon' instead of an 'app', but anyway those 'addons' then each promote all of their content into the the global space, and then there's a single master app (that we at that point call a 'suite') whose navigation then organizes all the views from the various component addons beneath it.

This is quite an undertaking and not without its downsides, but I mention this because if you're at the point where you have 20 or 50 views in there, you may be having other organizational problems you want to solve too...

Note: in an app folders for static files can have subfolders although many people dont know this (etc//appserver/static can have subfolders)

nik_splunk
Path Finder

Hi nick, as usual your answer fits perfectly my needings.
Thanks so much for your time

nik_

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...